Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2024, 01:06

General

  • Target

    03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe

  • Size

    558KB

  • MD5

    dc50baff9f1bab10f1ebc24e0d77afc3

  • SHA1

    29f4429939e57666b8a57c2d7b95a4801fa7ca20

  • SHA256

    03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7

  • SHA512

    6249ae2e738515d2f453310ad8e9730334997796477f88f0e1a72086154b0348b07da7c651b835f8e8b84ac43452fd0d87b5c40400d8a9a6297e802ae045a152

  • SSDEEP

    6144:mujuIGjAOphSW579i8fB106f91hYC1l+W8GSAZ2nxKdn3wGK570:LRaAODHVrB/lDH8gZhdAY

Malware Config

Extracted

Family

xworm

Mutex

سPيIXNtJمrCWpكxـاطMWEلD21LcبإA

Attributes
  • Install_directory

    %Port%

  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:380
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:672
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:956
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:736
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:652
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1048
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1056
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                    1⤵
                    • Indicator Removal: Clear Windows Event Logs
                    PID:1112
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1164
                    • C:\Windows\system32\taskhostw.exe
                      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                      2⤵
                        PID:2728
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                      1⤵
                        PID:1292
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                          PID:1304
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                          1⤵
                            PID:1384
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                            1⤵
                              PID:1404
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                              1⤵
                                PID:1448
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                1⤵
                                  PID:1464
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                  1⤵
                                    PID:1516
                                    • C:\Windows\system32\sihost.exe
                                      sihost.exe
                                      2⤵
                                        PID:2612
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1640
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                        1⤵
                                          PID:1676
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                          1⤵
                                            PID:1716
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1788
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                              1⤵
                                                PID:1836
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                1⤵
                                                  PID:1856
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1864
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:1940
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:2036
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:2056
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                            PID:2184
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                            1⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2236
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                            1⤵
                                                              PID:2284
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                              1⤵
                                                                PID:2404
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2412
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                  1⤵
                                                                    PID:2600
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                    1⤵
                                                                    • Drops file in System32 directory
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:2684
                                                                  • C:\Windows\sysmon.exe
                                                                    C:\Windows\sysmon.exe
                                                                    1⤵
                                                                      PID:2756
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                      1⤵
                                                                      • Enumerates connected drives
                                                                      PID:2784
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                      1⤵
                                                                        PID:2804
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                        1⤵
                                                                          PID:2824
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                          1⤵
                                                                            PID:2956
                                                                          • C:\Windows\system32\wbem\unsecapp.exe
                                                                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                            1⤵
                                                                              PID:1156
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                              1⤵
                                                                                PID:3356
                                                                              • C:\Windows\Explorer.EXE
                                                                                C:\Windows\Explorer.EXE
                                                                                1⤵
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of UnmapMainImage
                                                                                PID:3448
                                                                                • C:\Users\Admin\AppData\Local\Temp\03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe"
                                                                                  2⤵
                                                                                  • Checks computer location settings
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4436
                                                                                  • C:\Users\Admin\AppData\Local\Temp\wzcsapi.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\wzcsapi.exe"
                                                                                    3⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:4628
                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "wzcsapi" /tr "%Current%\wzcsapi.exe"
                                                                                      4⤵
                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                      PID:3124
                                                                                  • C:\Users\Admin\AppData\Local\Temp\wzcsvc.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\wzcsvc.exe"
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4108
                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                    C:\Windows\system32\WerFault.exe -u -p 4436 -s 1256
                                                                                    3⤵
                                                                                    • Checks processor information in registry
                                                                                    • Enumerates system info in registry
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:112
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                1⤵
                                                                                  PID:3576
                                                                                • C:\Windows\system32\DllHost.exe
                                                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                  1⤵
                                                                                    PID:3768
                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                    1⤵
                                                                                      PID:3952
                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                      1⤵
                                                                                        PID:4152
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                        1⤵
                                                                                          PID:3920
                                                                                        • C:\Windows\System32\svchost.exe
                                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                          1⤵
                                                                                            PID:5080
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                            1⤵
                                                                                              PID:1744
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                              1⤵
                                                                                              • Modifies data under HKEY_USERS
                                                                                              PID:2224
                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                              "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                              1⤵
                                                                                              • Drops file in System32 directory
                                                                                              • Modifies data under HKEY_USERS
                                                                                              PID:2016
                                                                                            • C:\Windows\system32\SppExtComObj.exe
                                                                                              C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                              1⤵
                                                                                                PID:972
                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                1⤵
                                                                                                  PID:2176
                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                  1⤵
                                                                                                    PID:832
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                    1⤵
                                                                                                      PID:3908
                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                      1⤵
                                                                                                        PID:4468
                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                        1⤵
                                                                                                          PID:1624
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                          • Modifies registry class
                                                                                                          PID:4276
                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                          C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                          1⤵
                                                                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:2196
                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 408 -p 4436 -ip 4436
                                                                                                            2⤵
                                                                                                              PID:4524
                                                                                                          • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                            C:\Windows\System32\WaaSMedicAgent.exe 69a6b1d07553dac49519cab6ceab8fe1 oxjCCojOX0q2/VhxbEgz4Q.0.1.0.0.0
                                                                                                            1⤵
                                                                                                            • Sets service image path in registry
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:1104
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              2⤵
                                                                                                                PID:4776
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                              1⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2320
                                                                                                            • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                              1⤵
                                                                                                              • Checks BIOS information in registry
                                                                                                              • Writes to the Master Boot Record (MBR)
                                                                                                              • Checks SCSI registry key(s)
                                                                                                              • Enumerates system info in registry
                                                                                                              PID:3184
                                                                                                            • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                              C:\Windows\servicing\TrustedInstaller.exe
                                                                                                              1⤵
                                                                                                                PID:716
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                1⤵
                                                                                                                  PID:1832
                                                                                                                • C:\Windows\System32\mousocoreworker.exe
                                                                                                                  C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                  1⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  • Enumerates system info in registry
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  PID:1812
                                                                                                                • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:740
                                                                                                                  • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                    1⤵
                                                                                                                      PID:1880
                                                                                                                    • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                      1⤵
                                                                                                                        PID:1488
                                                                                                                      • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                        "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                        1⤵
                                                                                                                          PID:1688
                                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:1660

                                                                                                                          Network

                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • C:\ProgramData\Microsoft\Windows\WER\Temp\WER8647.tmp.csv

                                                                                                                                  Filesize

                                                                                                                                  38KB

                                                                                                                                  MD5

                                                                                                                                  264a48bfdab201ad453b519e97826cc9

                                                                                                                                  SHA1

                                                                                                                                  41e003f6b3c5fc40275059f583c28af834496151

                                                                                                                                  SHA256

                                                                                                                                  9c125dd5459d0c8196bd16ba9f1f6b0555cf437f94571710168ced198193315a

                                                                                                                                  SHA512

                                                                                                                                  2b8626fa6411a4631a23af1684bca87d684f73f13197b53996330ec3b94ffbaf4588bf91a012865479136f9f9751b2725d5f7cce137d48eb9a5aeb301c780df4

                                                                                                                                • C:\ProgramData\Microsoft\Windows\WER\Temp\WER86A6.tmp.txt

                                                                                                                                  Filesize

                                                                                                                                  13KB

                                                                                                                                  MD5

                                                                                                                                  1b24147fd6bfa12e77aac837e70db93d

                                                                                                                                  SHA1

                                                                                                                                  f3969551c68c5ac1aabd0a95253e20b5a005966f

                                                                                                                                  SHA256

                                                                                                                                  03b7d984bfb10d1948d5f762e3628bf98892414313f930513f91d0dc08cbcfc6

                                                                                                                                  SHA512

                                                                                                                                  5f9658d713b589d909a9ce17dc2c689648461afb3f2d204ca475c800e2c0bf0a32d6cce76a08529e43756c3f6aebc3a6047168a23ebdd0c4479b3d940d95c21a

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                  Filesize

                                                                                                                                  328B

                                                                                                                                  MD5

                                                                                                                                  4cfcb9883f1e341f157878e4aabcbc13

                                                                                                                                  SHA1

                                                                                                                                  5fe6d8e7a7f7ed28c1130ed4ca41e0815bb20986

                                                                                                                                  SHA256

                                                                                                                                  1bad87a8a8a54143005428475c75b67c5dcef44d77fd362a2422f34f6e729643

                                                                                                                                  SHA512

                                                                                                                                  2994ed06cb6809d5d25eec17ea028aec33280dc7147b2de1d7b3edc3c6cc60709d7f485a16aeb52c7a24b20578c20cd0ad9c4e50b02e6ea8e2ce0622f8f82a75

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                                                  Filesize

                                                                                                                                  330B

                                                                                                                                  MD5

                                                                                                                                  c9658c4853ae5ce8525f4391544663ab

                                                                                                                                  SHA1

                                                                                                                                  b057dae97f33e904f7ca1e61588362f999d1ab78

                                                                                                                                  SHA256

                                                                                                                                  6f6f97c91cb196180724ef0e4e4f9cbe71a6b738eb2523fe641b77623829004b

                                                                                                                                  SHA512

                                                                                                                                  6ef003f7a93e2a771420a52a5beec8ee099bbdf64970a20527240c3382fb304a4e977d667f9620644bf2122ddadb3ac30601c0233306df08375a5f473a85c73c

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\wzcsapi.exe

                                                                                                                                  Filesize

                                                                                                                                  34KB

                                                                                                                                  MD5

                                                                                                                                  64ffe7c0fa6ac22f5acafd3ceb4aca5b

                                                                                                                                  SHA1

                                                                                                                                  104182708267ee1a6da0e9e83cb04df83edae120

                                                                                                                                  SHA256

                                                                                                                                  6b5c2e9a2ef36412b2636236ade5530c59573b51b07fe224fd980911cbb7b976

                                                                                                                                  SHA512

                                                                                                                                  f136d69bb6be51cf7e1e6f0e4538cb951337cb278344b348e749f67a6f08c1df01264bd3275ed9a36b776dfb1b9b75f31f8bcec102f8b50d50913aa883b13066

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\wzcsvc.exe

                                                                                                                                  Filesize

                                                                                                                                  161KB

                                                                                                                                  MD5

                                                                                                                                  a69c6e092d415063a9fb80f8fe4e3444

                                                                                                                                  SHA1

                                                                                                                                  8b26a0fd01b1e48f7110cffecf6bc3b9d0822e9a

                                                                                                                                  SHA256

                                                                                                                                  f7dd8d6299c108a3221c31bf33637f59f0e19703aaa88b1e3a4f1093e7209a5d

                                                                                                                                  SHA512

                                                                                                                                  4e69b49d65f68ff913afbc991f06509645ac69850182f557ca625ad5cf92832059ddadb4af547cfb4fd84c4b24cf55a1ce3d9d6d466112e9581908d4e4d2da38

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                                  SHA1

                                                                                                                                  98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                                  SHA256

                                                                                                                                  ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                                  SHA512

                                                                                                                                  c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  f313c5b4f95605026428425586317353

                                                                                                                                  SHA1

                                                                                                                                  06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                  SHA256

                                                                                                                                  129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                  SHA512

                                                                                                                                  b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                                  SHA1

                                                                                                                                  a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                                  SHA256

                                                                                                                                  98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                                  SHA512

                                                                                                                                  1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                  SHA1

                                                                                                                                  63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                  SHA256

                                                                                                                                  727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                  SHA512

                                                                                                                                  f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                  SHA1

                                                                                                                                  5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                  SHA256

                                                                                                                                  55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                  SHA512

                                                                                                                                  5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                  SHA1

                                                                                                                                  9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                  SHA256

                                                                                                                                  a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                  SHA512

                                                                                                                                  c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                • memory/380-47-0x000001F485050000-0x000001F48507B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  172KB

                                                                                                                                • memory/380-41-0x000001F485050000-0x000001F48507B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  172KB

                                                                                                                                • memory/380-42-0x00007FF8C2310000-0x00007FF8C2320000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/612-31-0x00000199D8BB0000-0x00000199D8BD5000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  148KB

                                                                                                                                • memory/612-32-0x00000199D8BE0000-0x00000199D8C0B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  172KB

                                                                                                                                • memory/612-33-0x00007FF8C2310000-0x00007FF8C2320000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/612-44-0x00000199D8BE0000-0x00000199D8C0B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  172KB

                                                                                                                                • memory/612-45-0x00007FF90232D000-0x00007FF90232E000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/672-46-0x00000162AB400000-0x00000162AB42B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  172KB

                                                                                                                                • memory/672-36-0x00000162AB400000-0x00000162AB42B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  172KB

                                                                                                                                • memory/672-37-0x00007FF8C2310000-0x00007FF8C2320000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/736-57-0x0000019DC56A0000-0x0000019DC56CB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  172KB

                                                                                                                                • memory/736-54-0x0000019DC56A0000-0x0000019DC56CB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  172KB

                                                                                                                                • memory/736-55-0x00007FF8C2310000-0x00007FF8C2320000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/736-394-0x0000019DC56A0000-0x0000019DC56CB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  172KB

                                                                                                                                • memory/956-52-0x00007FF90232C000-0x00007FF90232D000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/956-48-0x000001C869700000-0x000001C86972B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  172KB

                                                                                                                                • memory/956-49-0x00007FF8C2310000-0x00007FF8C2320000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/956-389-0x000001C869700000-0x000001C86972B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  172KB

                                                                                                                                • memory/956-51-0x000001C869700000-0x000001C86972B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  172KB

                                                                                                                                • memory/3448-99-0x00007FF8C2310000-0x00007FF8C2320000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/3448-98-0x0000000002F80000-0x0000000002FAB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  172KB

                                                                                                                                • memory/4108-30-0x00007FF900760000-0x00007FF90081E000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  760KB

                                                                                                                                • memory/4108-29-0x00007FF902290000-0x00007FF902485000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  2.0MB

                                                                                                                                • memory/4436-4-0x0000015051E90000-0x0000015051EB0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4436-5-0x00007FF8E41C0000-0x00007FF8E4C81000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                • memory/4436-1-0x00000150500C0000-0x0000015050150000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  576KB

                                                                                                                                • memory/4436-2-0x0000015051E30000-0x0000015051E90000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  384KB

                                                                                                                                • memory/4436-0-0x00007FF8E41C3000-0x00007FF8E41C5000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                • memory/4436-58-0x00007FF8E41C3000-0x00007FF8E41C5000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                • memory/4436-3-0x0000015050520000-0x000001505054A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  168KB

                                                                                                                                • memory/4436-339-0x00007FF8E41C0000-0x00007FF8E4C81000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                • memory/4436-348-0x00007FF8E41C0000-0x00007FF8E4C81000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                • memory/4628-25-0x0000000000E40000-0x0000000000E4E000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  56KB

                                                                                                                                • memory/4628-399-0x00007FF902290000-0x00007FF902485000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  2.0MB

                                                                                                                                • memory/4628-28-0x00007FF8E41C0000-0x00007FF8E4C81000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                • memory/4628-376-0x00007FF902290000-0x00007FF902485000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  2.0MB

                                                                                                                                • memory/4628-384-0x00007FF8E41C0000-0x00007FF8E4C81000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                • memory/4628-377-0x000000001C2A0000-0x000000001C2AE000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  56KB